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Abstract. We study the communication complexity of the direct sum 
of independent copies of the equality predicate. We prove that the prob- 
abilistic communication complexity of this problem is equal to O(N); 
computational complexity of the proposed protocol is polynomial in size 
of inputs. Our protocol improves the result achieved in Our con- 
struction is based on two techniques: Nisan's pseudorandom generator 
[J and Smith's string synchronization algorithm [5]. 



1 Introduction 

In this paper we study amortized communication complexity of the equality 
predicate. We deal with the classic model of communication complexity with 
two participants (Alice and Bob), who want to compute some function of the 
data distributed between the participants. Alice and Bob can talk to each other 
via a communication channel. We measure the number of bits that must be 
transmitted between Alice and Bob to achieve the goal. 

More specifically, let / : {0,1}" x {0,1}" — > {0,1} be a function of two 
arguments. We assume that Alice is given the value of x, Bob is given the value 
of y, and Alice and Bob communicate with each other to compute the value 
f(x,y). We denote by C(f) deterministic communication complexity of function 
/, i.e., the minimal number of bits that should send by Alice and Bob to each 
other to get f(x, y). 

Further, let us denote by f N the direct sum of N independent copies of the 
initial function /. More formally, the two arguments of / are an iV-tuples of 
values (xi, . . . , xn) and TV-tuple of values (j/i, . . . , yisr), and 

f N (x 1 ,...,x N ,y 1 ,...,y N ) = (f{x 1 ,y 1 ), f(x N , y N )). 

We assume that Alice is given all values of Xi , and Bob is given all values of yi . 
Now ALice and Bob need to compute / , i.e., to get all the values f(xi,yi) for 
i = 1, . . . , N. Amortized communication complexity of / is defined as 

fN 

AC(/) = limsup V- 



It was proven in [IT] that AC(f) = f2(y/C(f) - logn). 



In a similar way, amortized communication complexity can be denned for 
probabilistic version of communication complexity. In general, the properties of 
amortized randomized communication complexity remains not well understood, 
though several nontrivial particular examples are known. For instance, in 
it was proven that amortized randomized complexity of the equality predicate is 
only O(l), while it is known that for one individual predicate EQ : {0,1}" x 



randomized communication complexity is equal to 0(\ogn). 

In our paper we construct a new randomized communication protocol for 
the direct sum of the equality predicate. Our protocol is computationally ef- 
fective, i.e., it only requires polynomial computations for Alice and Bob. Our 
construction improves the result from [TT] in two respects. First of all, we get a 
slightly better bound for the probability of error. And, second, our protocol has 
a "modular" structure; it consist of several independent gadgets, which make the 
construction more flexible. We hope that the same technique can be applied to 
other problems of communication complexity. 

Our principal result can be formulated as follows: 

Main theorem. Probabilistic communication complexity (for the private coin 
model) of a direct sum of N equality predicates is equal to O(N) , with probability 

of the error P err < 0(2 lo s 2 « ). Moreover, we explicitly construct a communi- 
cation protocol that achieves this communication complexity and requires only 
polynomial time computations on Alice's and Bob's sides. 

In our construction, we use several classic tools (N. Nisan's pseudorandom 
generator, BCH codes, deterministic synchronization protocol by A. Orlitsky) 
and one relatively new construction (A.Smith's probabilistic synchronization 
protocol). 

1.1 Model 

We use three standard models of communication complexity: deterministic com- 
munication protocols, randomized communication protocols with public random 
bits, and randomized communication protocols with private random bits, see 
Nisan's and Kushlevitz's textbook [T|. We done communication complexities for 
these three models by Cdet, C pu b, and C pr i V respectively. 

Our principal construction is in a sense, an explicit and effective implemen- 
tation of the following theorem for some particular communication protocol. 



Theorem 1 (Comm. Compl. pQ). Let f : {0,1}™ x {0,1}" ->■ {0,1} be a 
function of two arguments. For every 8 > and every e > 0, it holds 



{0,1}"->{0,1} 




< CLtif) + 0(logn + logtT 1 ). 



1.2 Our main problem 

Equality predicate (EQ n ). First of all, we remind the following classic prob- 
lem of communication complexity. Alice and Bob each hold an n-bit string, x 
and y respectively. They want to know whether x — y. Formally, they want to 
compute the value of the predicate 



Direct sum of equality functions (EQ 1 ^). Both Alice and Bob hold some 
array of N of n-bits blocks. Formally, inputs of Alice and Bob are bit strings 
of length n ■ N. But it is more instructive to represent the input of Alice as 
x = x 1 . . . x N and the input of Bob as y = y 1 . . . y N , where Xi, yi € {0, l} n for 
each i = 1,...,N. Then we define EQ% as EQ^{x,y) = z e {0,1}^, where 
each i-th bit of z is equal to 1 iff x % = y l . Intuitively this means that Alice and 
Bob wants to compute the value of the predicate EQ n for N independent pairs 
of inputs (x l ,y l ). 

Communication complexity of the function EQ 1 ^ is the main subject of our 
paper. More precisely, we want to estimate the probabilistic communication com- 
plexity of this function in the model with private sources of randomness. 

2 The known results 

2.1 Complexity of EQ n for different types of communication 
protocols. 

The predicate EQ n is pretty well studied, and its communication complexity are 
well understood. Let us remind three different communication protocols for this 



2.1.0.1 Deterministic model. It is known that Cdet(EQn) = n+1. The bound is 
achieved by a trivial protocol: Alice transmits her string x to Bob, Bob compares 
the two strings x and y and sends back one-bit response, 1 if the strings are equal 
and otherwise. From the standard technique of fooling sets it follows that this 
bound is tight, i.e., there is no protocols with communication complexity less 
than n + 1. 

2.1.0.2 Private coin model For the randomized communication complexity with 
private sources of randomness C^ riv (EQ n ) = 0(\og j). This bound is achieved 
by several classic communication protocols. In what follows we describe one of 
them. Alice and Bob view their inputs x and y as n-digits binary representations 
of integers (between and 2™ — 1 ) . Alice chooses a prime number p at random 
among the first (n/e) primes. She sends to Bob both p and x mod p. Bob verifies 
whether x mod p = y mod p. If x and y are equal to each other modulo p, then 
Bob returns outputs 1, otherwise he returns 0. 

If x — y, then this protocol always return the correct result. If x ^ y, then 
the difference (x — y) has at most n prime factors; hence, the protocol returns 
the wrong answer with probability at most e. 




predicate. 



2.1.0.3 Public coin model For the randomized communication complexity with 
public sources of randomness 

C^ b (EQ n ) = O(logi). 

This bound for the communication complexity is achieved by the following proto- 
col. Alice and Bob jointly choose a random n-bit string n. Then Alice computes 
the inner product b = (x, r) and transmits the result (a single bit) to Bob. Bob 
checks whether b = (y, r) and outputs "equal" if so and "not equal" otherwise. 
Obviously, if x = y, then the output is always "equal." On the other hand, if 
x 7^ y, then by the properties of the inner product, Pr[(x, r) ^ (y, r}] = i. Thus, 
Bob outputs "not equal" with probability i. To decrease the probability to get 
the wrong answer, Alice and Bob should repeat these procedure several times 
with several independently chosen random strings r. If Alice and Bob repeat (in 
parallel or sequentially) I times the discribed procedure, then the probability 
that (x,r) ^ (y,r) for all n,...,ri is equal to 2~ l . So, for I = [logl/e] we 
reduce the probability to get an error to e, while communication complexity is 
0(Iogl/e). 



2.2 Trivial generalizations for EQ™ 

The protocols from the previous section can be easily adapted to get some pro- 
tocols for the direct sum of N copies of EQ n , i.e., for the function EQ^ . 

2.2.0.4 Adaptation of the protocol from varaaravh \2.1. 0.H We run the protocol 
independently for each pair of blocks (xi,yi). The probability to get a wrong 
answer for at least one pair of blocks must be bounded by e. To this end we 
need to reduce the probability of an error for each of N pairs of blocks to be less 
than e' — e/N. This results in communication complexity 0(N(log(n/e'))) = 
0(A(log ?i + log A^ + log 1/e))). Thus, from the trivial adaptation of the protocol 
from paragraph 12 . 1 . . 2l we get 

C; riv (EQ N ) = 0(N (log n + log N + log 1/e))) 

2.2.0.5 Adaptation of the protocol from varaaravh \2.1.0.3~\ We run the protocol 
from section [2.1.0.31 for each pair of blocks (xi,yi) independently. To guarantee 
than the total probability of the error is bounded by e, we need to reduce the 
probabilities of errors for each pair of blocks to e' = e/N. Then we get 

C; ub (EQ N ) = 0(N(logN + logl/e))) 

2.2.0.6 From public to private randomness The last protocol above can be 
transformed into a protocol with private sources of randomness. Indeed, from 
theorem [T] we get immediately 

C priv = 0(N ■ log N + log - + log(n ■ N) + log h = 

e 



= 0(N • log N + log n + log N + log -) = 0{N ■ log N) 

t 

Note that this communication protocol requires exponential computational com- 
plexity (at least for the standard proof of theorem [T]). 

Can we reduce the obtained (rather trivial) bound 0{N • log N), hopefully to 
0(N)7 Can we achieve this bound with a communication protocol that requires 
only poly-time computations? The answers both these questions are positive. 
Construction of such a communication protocol is the main result of this paper. 
Loosely speaking, we plan to do it in two steps. At the first step, we construct 
more effective communication protocol for communication model with public 
randomness (this part of our construction is based on ideas of A. Smith). At 
the second step, we reduce this protocol with a public source randomness to 
a protocol with private randomness. In some sense, this idea is similar to the 
usual proof of theorem [1] we substitute the sequence of random bits (shared by 
Alice and Bob) by a sequence of pseudorandom bits, which can be obtained as 
an output of a pseudo-random bits generator. A random seed of this generator 
is rather short. So, one of participants can choose it at random and then send 
to another participants. E.g., Alice choses a random seeds and send it to Bob; 
then ALice and Bob apply the pseudo-random bits generator to this same seed, 
and then both participants share the same long string of pseudo-random bits. 
The sharp difference between our construction and the standard general proof 
of theorem [T] is that we use an explicit and effectively computable generator (the 
generator of N. Nisan). 

Before we explain details of our construction, we remind the technical tools 
used in our proof. 

3 The tools used in our construction 
3.1 Pseudorandom number generator 

In our construction we need a pseudo-random generator that fools tests with 
a bounded memory. Technically, we assume that a generator is a mapping G : 
{0,1}'™ — > {0,1}", and a test is a randomized Turing machine with working 
space of some size S. 

Definition. A function G : {0,1}'™ — > {0,1}" is called a pseudorandom 
generator is e-robust for tests with space S, if for every statistical test A with S 
bits of working space 

\Pf v e r {o,i} n [A accepts y] - Pr yer ^ Q ^ m [A accepts G(x)} \ < e. 

By statistical test we mean the following construction. 

Definition A statistical test with space S(n) is a deterministic Turing ma- 
chine M with three tapes: a working tape of size space S(n), an auxiliary read- 
only tape with some binary strings a = (oi, ...a„, ...) (an advice string), and a 
one-way input tape with an n-bits input x (the reading head on the input tape 
can move from the left to the right but cannot move back to the left). We always 



assume that the length of a should not be greater than exp(S(n)). This machine 
returns input 1 or input 0. We denote this result M a (x). Informally the output 
means that test accepts/rejects x given an advice string a. 

Nisan suggested in [3] an explicit construction of a pseudo-random gener- 
ator that fools tests with small enough memory. This result of Nisan can be 
formulated as follows. 

Theorem 2. There exists a constant c > such that for any R and S there 
exists a pseudorandom generator G : cS log R — > R (computable in time poly(R)) 
that is 2~ -robust for statistical tests with S bits of working space. 

In section 14.3.31 we construct some statistical test, which verifies that a 
(pseudo)random string x is suitable for our communication protocol. Then, we 
use the standard argument: our protocol with high probability returns the cor- 
rect answer when it runs with truly random public bits; futher, the generator of 
Nisan fools our test; hence, given In section T4.3. 31 we construct some statistical 
test that tests that a random string is suitable for our communication protocol. 
Then, we use the standard argument: the protocol with high probability returns 
the correct answer if runs on truly random public bits; futher, the generator of 
Nisan fools our test; hence, given pseudo-random bits instead of truly random 
ones, the communication protocol must also returns the correct answer with 
hight probability. 

3.2 BCH codes 

We also use in our construction the classic BCH-codes, see [12]. We do not 
employ any specific properties of the construction of the BCH codes. We use 
only the fact that Vm > 3,t < 2 m ~ 1 exists an explicit construction of a linear 
code with parameters [n, k, d] such that codeword length n = 2 m — 1, the number 
of checksum bits is n — k < mt, and the minimal distance between of the code is 
d > 2t + 1 . We also use the fact that the BCH codes can be decoded efficiently 
(by Berlekamp-Messy algorithm), |13| . 

The BCH construction is not explicitly used in the article. Still, Orlitzky's 
construction 13.31 we do utilize, needs an error-correcting code, which is not ex- 
plicitly given in Orlitzky's article. The BCH code is fits in his construction and 
we are going to use it when refering to Orlitzky's construction. 

3.3 Strings synchronization protocols 

In our communication protocol we will need to solve the following auxiliary 
problem. Let Alice and Bob each hold an n-bits string, A and B respectively. 
We assume that A and B differ from eahc other in at most e positions. Alice 
and Bob want to exchange their inputs, i.e., Alice should get string B, and Bob 
should get string A. We will call this problem by string synchronization problem 
(Alice and bob want to synchronize their inputs). 

Orlitsky suggested in [3] a deterministic communication protocol for the prob- 
lem of synchronization of a pair n-bits strings at the Hamming distance at most 



e. Communication complexity of this protocol is O(elogn). All computations of 
Alice and Bob in this protocol run in polynomial time. 

More formally, the theorem (formulation taken from [5]) looks the following: 

Theorem 3. Given an error- corrcting code with parameters (a.R(a)) which sat- 
isfies the following conditions: 

1. It is linear. 

2. An effective decoding algorithm exists. 

A one-round communication protocol with communication complexity C = 
(1 — R{ct)) ■ n can be constructed. Computational complexity of such protocol is 
polynomial. 

If using the BCH code(noted in section 1572)) . the communication complexity 
of this protocol is: O(elogn) 

The protocol of Orlitsky makes sense if the distance e between strings is very 
small. In case e = f2(n), communication complexity of the protocol of Orlitsky 
is worse than the trivial bound 2n. 

Adam Smith suggested in [9] a randomized communication protocol for the 
problem of strings synchronization, with asymptotically optimal bound for com- 
munication complexity for the case e = const ■ n. More precisely, Smith proved 
that for every S = S(n) = i7( 1 ^° s ? " ) there exists an explicit family of com- 
munication protocols (with private sources of randomness) that solve the prob- 
lem for synchronization of n bit strings at that differ in at most e positions, 

with communication complexity n(H(^) + S) and error e = 2~ n ^ l °& n \ where 
H{p) = p\og 2 - + (1 — p) log j-^. Algorithms of Alice and Bob in this protocol 
run in polynomial time. 

4 The main result 

4.1 Formulation 

By EQ n we denote an equality predicate problem, by EQ^ we denote a direct 
sum of such problems. 

Theorem 4. Probabilistic communication complexity (for the private coin model) 

c ^ 

of a EQn is equal to O(N), with an error probability P err < 0(2 1o <s 2 N ) if n < 
N. Moreover, there exists a protocol with the required communication complexity 
and only polynomial time computations for Alice and Bob. 

4.2 Overview of the protocol 

Our protocol runs as follows. First of all, Alice generates a string of truly random 
bits of length O(N) and send this string to Bob. They both generate pseudo- 
random bits from this seed. In what follows, Alice and Bob use this long string 
of pseudo-random bits. 



Then, Alice and Bob iteratively calculate "checksums" (inner products with 
pseudo-random string) for their n-bits blocks and synchronize strings of resulting 
checksums using the probabilistic or the deterministic protocol from section [3~3l 
As soon as some pair of non-equal blocks X 1 , Y % is revealed (if some checksums 
for these blocks are different), Alice and Bob withdraw these blocks from the list 
of their bit strings and never test them again. Thus, on each next iteration the 
fraction of non-equal pairs of blocks (that are not discovered yet) becomes less 
and less. 

On each next iteration, we make the length of checksums longer and longer, 
so for each pair of non-equal blocks the probability to be discovered becomes 
closer and closer to 1. Hence, the fraction of (non-discovered) pairs of non-equal 
blocks gradually reduces, and only pairs of equal blocks remain untouched at 
their places. This means that on each next iteration the Hamming distance 
between arrays of checksums (obtained by Alice and Bob respectively) becomes 
less and less. 

On each iteration Alice and Bob need to exchange the checksums computed 
for their blocks of bits (inner products with the same pseudo-random bits) . For 
several first iterations (technically, for log log N iterations) we use the random- 
ized synchronization protocol by Smith. Then we switch to the deterministic 
protocol by Orlitsky. 

In what follows we explain this protocol in more detail. 



4.2.1 Generation stage Alice generates 

r = log (n ■ AO ■ log(2 ) = 0{N) 

random bits and sends them to Bob. Then Alice and Bob apply Nisan's pseudo- 
random generator from section l3Tl and get R = n 2 N 2 pseudo-random bits. The 
length of the seed r is chosen so that the generator is e-robust against tests with 
working space of size log ^. N) ■ 

4.2.2 Probabilistic synchronization stage, steps % — 1, . . . , log log TV) 

Synchronization protocols we use expect to know the distance between strings 
in advance. As we may not know an initial distance between X and Y, we will 
add N dummy, equal blocks to X and Y. This will guarantee the share of non 
equal pairs to be less then 0.5. This is a coarse trick, but it will not affect the 
asymptotic complexity of our protocol. 

We repeat log log A times the following procedure. We let \ = lo | N . Alice 
and Bob calculate checksums of length A; for each of their blocks (that are 
not yet proven to be different). The checksum for each block consists of inner 
products modulo 2 between this block and a new portion of pseudorandom bits 
generated on the previous stage. Thus, the resulting checksums (for Alice and 
Bob) consists of XiN bits. 

Then Alice and Bob exchange their checksums using the randomized protocol 
of strings synchronization; when we apply this protocol, we assume that Alice's 
and Bob's checksums differ from each other in a fraction at most 2~\ 



When the checksums are exchanged, Alice and Bob remove from their lists 
the blocks X 1 , Y l whose checksums are not identical. 

Note that for a pair of equal blocks X 1 , Y l , the checksums are always equal. 
If blocks are not equal to each other, the chance to get all equal checksums is 
about 2~ Ai (this probability is not exactly 2~ Ai since Alice and Bob use not 
random but pseudo-random bits to compute the inner products) . 

Typically, on each step the number of non-discovered pairs of non-equal 
blocks X 1 -, Y l becomes more than twice less. We say that the i-th step of the 
described procedure fails, if at this stage Alice and Bob discover less than 50% 
of the pairs of non-equal blocks X 1 , Y % (less than a half of all pairs of non-equal 
blocks that was not discovered earlier) . If at least one step fails, we cannot guar- 
antee correctness of the result of the protocol. If no steps fail, then on each i-th 
step the arrays of checksums of Alice and Bob differ from each other in a fraction 
at most 1/2* of all computed inner products. 

Communication complexity of this stage is the sum of communication com- 
plexities of copies of Smith's protocol run for each step i = 1,. . ., log log N: 

log log N 

H(l/T)X t N = 0(N). 

The last equation follows from the choice of Xi and the asymptotic H(a) = 
alog(l — a) + 0(1) as a tends to 0. 

4.2.3 Deterministic synchronization stage, steps i = log log 7V+1, . . . , log 

At this stage we continue essentially the same procedure as at the prevoius stage. 
On each step Alice and Bob get = lo ^z N bits of random checksums for each 
pair of blocks (that are not proven yet to be not-equal) by computing the inner 
products with new portions of pseudo-random bits; then Alice and Bob exchange 
the computed checksums. The difference is only how the participants exchange 
their checksums. Now they use the deterministic protocol by Orlitsky instead of 
the instead of probabilistic protocol by Smith, see section 13.31 

Communication complexity of the deterministic protocol is about log N times 
grater than complexity of the protocol by Smith. But nevertheless we can use it 
since the value of Xi is reasonably small. The communication complexity of this 
stage is 

^ 2 l 1 ^ log 2 N ■ 2 % 

2=loglog./V i=log log N ° 

4.2.4 Summary When the described stages are completed, we believe that 
Alice and Bob has found all pairs of non-equal blocks. In all remaining pairs X 1 , 
Y % (in all pairs of blocks whose checksums at all steps of the protocol were equal 
to each other) are considered equal. 



4.3 Probability of an error 



We need to estimate the probability of an error in our protocol. For simplicity, let 
us assume at first, that instead of R pseudo-random bits Alice and Bob share R 
independent and uniformly distributed random bits (so, we temporarily switch 
to the model with a public source of randomness) . Then stages 14.2.31 and 14.2.31 
make sense, and we can estimate the probability of an error in the protocol. 
The protocol may return a wrong answer because of the following reasons: 

1. The probabilistic synchronization protocol of Smith's fails at some stage. 

2. Some of steps i = 1, . . . , logiV fails since to many random checksums are 
equal for non-equal pairs of blocks X 1 , Y % . 

Let us bound probabilities of each of these bad events. 

4.3.1 Error in the probabilistic synchronization. We sum up the prob- 
abilities of errors in Smith's synchronization at each step of our protocol: 



for some constant c > 0. 

4.3.2 The failure of because of checksums Some step i = 1,..., log AT 

fails if for more than a half of (not discovered yet) pairs of non-equal blocks X 1 , 
V all random checksums turn out to be equal. We estimate the probability of 
this event with Chernoff's inequality. We may assume that after the first (i — 1) 
steps there remain N/2 1 pairs of pairs of non-equal blocks. 

We use our checksum scheme like some kind of a filter. That is - we "test" 
each pair of blocks on equality using calculated checksum of length A. If the 
pair consists of non-equal blocks, then the test either successfully discoveres it 
(with probability 1 — 2~ A ) or not. The failure happens if less then a half of tests 
succeed. We estimate the probability of failure using Chernoff's inequality. 

Formulating differently: On each step i, the |~ (amount of undiscovered pairs) 
tests are performed, each failing with probability 2~ Xi =. The whole step fails if 
more than a half of the tests fail. 

For one step, this probability can be estimated: 



log log JV 




i = l 



P(Filtering out less then 1/2 pairs) < 2 



Where 



D(q,p) = qhx(-) + (1 - q)hx(- -), and q = -,p 

p 1 — p 2 



1 

2^ 



Substituting A 



2 



this error probability is less then 



log 2 JV ' 



P{Ern) < 0(2~1 J_ ) = 0(2 



) 



Summing error probabilities for all steps of stages 2 and 3: 

log N 

0(2~T^h) w log TV • 0(2"^) « 0(2"^ +loslosAr ) < 0{2~ c ^) 

1=1 

4.3.3 Pseudorandom generator In this section we construct a statistical 
test (see the definition in section 13. 10 that simulates one step of our protocol. 
In a sense, this test verifies that (pseudo)random bits are "suitable" for our 
communication protocol: they do not cause the failure of the protocol at the i-th 
iteration. 

The "advice strings" of this statistical test contains a sequence of pairs of 
blocks X 1 , Y % from the inputs Alice and Bob, that were not shown to be not 
equal before iteration i. The test should work correctly for all advice strings that 
correspond to the possible internal states of Alice and Bob at the beginning of 
iteration i. 

The input x is a string of (pseudo)random bits that should be accepted or 
rejected. The test must reject x (for some advice string a), if our communication 
protocol "fails" at the i-th iteration with this random bits x while Alice and Bob 
are given the blocks X % . Y l corresponding to the advice a. 

The algorithm of the test is straightforward: it computes the checksums for 
X % and Y % as it is done by our communication protocol at the i-th iteration, 
with random bits x shared by Alice and Bob, and compares the corresponding 
checksums for Alice's and Bob's blocks. Note that the test does not simulate 
the synchronization procedure (the sub-protocols following the construction of 
Orlitsky and Smith). 

The working space of our machine is O( lo ^ N ). This is enough to simulate 
the computation of the checksums performed by our communication protocol. 
The test accepts x, if in the simulation at least 50% of non-equal pairs of blocks 
are is successfully revealed, and rejects x otherwise. In other words, a teststring 
x is rejected if it causes a failure at the i-th iteration of the protocol. 

Theorem l3 . 1 1 guarantees that Nisan's pseudo-random generator fools this test. 
Hence, for our protocol the probability of failure with pseudo-random bits is not 
much greater than the probability of failure for truly random bits. More precisely, 
difference between the probabilities of failure for random and pseudo-random bits 
is at most 

a - N 

2~ s = 0(2 C I^"). 

Technically, we should sum up this difference for all steps i = 1,..., log TV, 
but this does not change the asymptotics: P(Err) < ^.^^ 0(2 '°s 2 N ) = 
0(2" C3 ^) 



4.3.4 Summary Probability of the error of our protocol consists of three 
parts: (1) probability of an error in Smith's protocol, (2) probability of failure 



with truly random checksums on some step i = 1, . . . , log N , and (3) the addi- 
tional probability of failure caused by the difference between truly random and 
pseudorandom checksums: 

P(Err) = 0(2~ Cl{ ^>) + 0(2 C2 ^^) + 0(2" c:, ^n ) = 0(2 c ^i^). 

This concludes the proof of correctness of our communication protocol. Com- 
pared to the previous results (presented in [TT]): P(Err) = 0(2~ v ^), our proto- 
col provides better probability of error. 
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